KR101583306B1 - Analysis method and analysis apparatus of executable file applied virtualization obfuscation - Google Patents

Abstract

The present invention relates to a virtual obfuscation method for extracting components of a virtualization obfuscation technique applied to an executable file to help analyze an executable file to which a virtualization obfuscation technique is applied and applying a virtualization obfuscation technique for providing information on the extracted components And an analyzing method and an analyzing apparatus of an executable file.
By using the present invention, components of the virtualization obfuscation technique applied to the executable file can be grasped, the analysis object can be easily recognized in the executable file, and the actual control flow of the executable file can be known.

Description

TECHNICAL FIELD [0001] The present invention relates to an analysis method and an analysis apparatus for an executable file to which a virtualization obfuscation technique is applied.

The present invention relates to an analysis method and an analysis apparatus for an executable file to which a virtualization obfuscation technique is applied. More particularly, the present invention relates to a virtualization obfuscation technique applied to an executable file to help analyze an execution file to which a virtualization obfuscation technique is applied The present invention relates to an analysis method and apparatus for an executable file to which a virtualization obfuscation technique is applied, in which information about extracted and extracted components can be provided.

The obfuscation technique is a technique used to make reverse engineering difficult by transforming the structure inside the program while maintaining the original functionality of the program. One of the obfuscation techniques, virtualization obfuscation, is a technique that makes it difficult to analyze the translated machine language by converting the code area to be protected in the program into another kind of machine language (virtualization code).

A virtual processor, which is composed of software, is used to interpret and process the virtualization code of the program to which the virtualization obfuscation technique is applied. The virtual processor is configured to interpret the virtualization code in software and perform the corresponding function directly on the actual processor, and the virtualization code need not be restored to the original code. Accordingly, the problem of analyzing the virtual obfuscation technique is identified with the problem of analyzing the virtual processor.

This virtual obfuscation technique is designed to protect the intellectual property of the program. Because the amount of code generated by the virtualization obfuscation technique is larger than the amount of original code and the complexity of the internal structure, the virtualization obfuscation technique is regarded as a suitable means for protection of intellectual property rights.

In general, virtualization obfuscation techniques are applied to program executables using commercial software tools. Commercial software tools for applying virtualization obfuscation techniques include Themida, Code Virtualizer, and VMProtect. This commercial tool virtualization obfuscation technique does not disclose its virtualization structure including a virtual processor, and obfuscation technique is applied to each component in the virtualization structure to make analysis more difficult.

On the other hand, commercially available software tools that can apply virtualization obfuscation techniques can be exploited because they are tools that can be purchased and used by anyone. Especially if these commercial software tools are used to protect malicious code, malicious code can not be analyzed or expected to be several hundred times longer than usual analysis time.

For example, a debugger is known that can load a program to analyze the program and verify the execution order of the program. It is virtually impossible to identify the virtualization code that uses virtualization obfuscation techniques using this debugger without knowing the virtualization structure is malicious code or what function it is performing. Furthermore, it is even more difficult for a debugger to move between various program codes using a program counter (PC) or the like, and to know whether the virtualization code entangled with the complicated structure is malicious code.

Thus, it is easy to apply the virtualization obfuscation technique to malicious code, but it is difficult to reverse obfuscate, and it is increasingly difficult to cope with malicious code.

As described above, an analysis method and an analysis apparatus of an executable file that employs a virtualization obfuscation technique that extracts a virtualization structure applied to a virtualization obfuscation technique from an executable file to which the virtualization obfuscation technique is applied and enables analysis of the executable file need.

Disclosure of Invention Technical Problem [8] The present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to provide an analysis method and analysis apparatus of an executable file to which a virtualization obfuscation technique for identifying components of a virtualization obfuscation technique applied to an executable file is applied. There is a purpose.

The present invention also provides an analysis method and apparatus for an executable file to which a virtualization obfuscation technique is applied to identify components of a virtualization obfuscation technique applied to an executable file and to provide log data related to the identified components It has its purpose.

It is another object of the present invention to provide an analysis method and an analysis apparatus for an execution file to which a virtualization obfuscation technique is applied to enable a control flow between handler codes of an executable file to which a virtualization obfuscation technique is applied by using a dynamic tracing technique have.

Another object of the present invention is to provide an analysis method and an analysis apparatus for an executable file to which a virtualization obfuscation technique for analyzing an executable file generated by a commercial software tool applying a virtualization obfuscation technique is applied.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, unless further departing from the spirit and scope of the invention as defined by the appended claims. It will be possible.

According to another aspect of the present invention, there is provided a method of analyzing an execution file to which a virtualization obfuscation technique is applied, the method comprising: (b) identifying a component applied to a virtualization obfuscation technique from first log data generated based on an execution file; and c) generating second log data capable of recognizing information associated with the identified component.

In addition, the component applied to the virtualization obfuscation method includes a dispatch loop for executing handler code corresponding to the virtualization instruction included in the executable file, and step (b) of the method for analyzing the execution file to which the virtualization obfuscation technique is applied, (b-1) identifying a code region of the dispatch loop.

In addition, the component applied to the virtualization obfuscation technique further includes a plurality of handler codes executed by the dispatch loop, and step (b) of the method of analyzing an executable file to which the virtualization obfuscation technique is applied includes steps (b-2) b-1) of the plurality of handler codes using instructions in the code area of the dispatch loop identified in step (b-1).

In addition, step (b-1) of the analysis method of the executable file to which the virtualization obfuscation technique is applied corresponds to the first instruction related to the virtualization instruction and the virtualization instruction corresponding to the virtualization instruction Recognizing a second instruction to call the handler code to determine a start address and an end address of the dispatch loop from the location of the recognized first instruction and the second instruction.

The method of analyzing an execution file to which a virtualization obfuscation technique is applied may further include: (a) loading an executable file into a dynamic emulator, including all instructions executed in the dynamic emulator, Further comprising generating and recording first log data capable of expressing an instruction, wherein the first log data in step (b) is the first log data generated and recorded in step (a).

The second log data generated in the step (c) includes information indicating a start address and an end address of the dispatch loop, information indicating the execution count of each of the plurality of handler codes, and information indicating execution order between the plurality of handler codes .

The second log data generated in step (c) further includes information indicating a start address of the handler code, an instruction contained in the handler code, an operand included in the instruction, and an execution order of the handler code.

According to another aspect of the present invention, there is provided an apparatus for analyzing an execution file to which a virtualization obfuscation technique is applied, the apparatus comprising: a component identification module for identifying a component applied to a virtualization obfuscation technique from first log data generated based on an execution file; And a log generation module that generates second log data that can recognize information associated with the identified component.

Also, the components applied to the virtualization obfuscation technique include a dispatch loop for executing the handler code corresponding to the virtualization instruction included in the executable file, and the component identification module identifies the code area of the dispatch loop.

In addition, the components applied to the virtualization obfuscation technique further include a plurality of handler codes executed by the dispatch loop, and the component identification module further uses the instructions of the code area of the identified dispatch loop to further define the area of the plurality of handler codes .

Further, the executable file is an executable file generated by applying dummy to the commercial virtualization obfuscation tool. The component identification module recognizes a first instruction related to the virtualization instruction and a second instruction for calling the handler code corresponding to the virtualization instruction The start and end addresses of the dispatch loop are determined from the positions of the recognized first and second instructions to identify the code region of the dispatch loop.

Also, the analysis apparatus of the executable file to which the virtualization obfuscation technique is applied includes an emulation module for generating and recording first log data that can load all the executable files and include all the commands executed dynamically, And the component identification module identifies components applied to the virtualization obfuscation technique from the first log data generated and recorded through the emulation module.

The method and apparatus for analyzing an executable file to which the virtualization obfuscation technique according to the present invention is applied can be understood as an element of the virtual obfuscation technique applied to an executable file.

In addition, the method and apparatus for analyzing an executable file to which the virtualization obfuscation technique according to the present invention is applied can identify the components of the virtualization obfuscation technique applied to the executable file and provide log data related to the identified component So that the analyst who analyzes the virtualization code can easily understand the analysis target.

Also, the method and apparatus for analysis and analysis of an executable file to which the virtualization obfuscation technique according to the present invention is applied may be configured to recognize the actual control flow between handler codes of an executable file to which the virtualization obfuscation technique is applied by using a dynamic tracing technique .

In addition, the method and apparatus for analyzing an executable file to which the virtualization obfuscation technique according to the present invention is applied can analyze an executable file generated by a commercial software tool applying the virtualization obfuscation technique.

The effects obtained by the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those skilled in the art from the following description will be.

1 is a diagram illustrating an exemplary hardware block diagram of an executable file analysis apparatus to which a virtual obfuscation technique is applied.
2 is a diagram illustrating the components of the virtualization obfuscation technique.
3 is a diagram illustrating an exemplary control flow of an executable file analysis method to which a virtual obfuscation technique is applied.
4 is a diagram illustrating a virtualization structure of a virtualization obfuscation technique generated by a commercial software tool dummy.
5 is a diagram showing exemplary information of log data generated according to the present invention.
6 is a diagram showing still another exemplary information of log data generated according to the present invention.
7 is a block diagram illustrating an exemplary functional block for analysis of an executable file to which a virtual obfuscation technique is applied.

The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: It can be easily carried out. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 illustrates an exemplary hardware block diagram of an executable file analysis apparatus 100 to which a virtual obfuscation technique is applied.

1, an analysis apparatus 100 includes an input interface 101, an output interface 103, a memory 105, a mass storage medium 107, a system bus / control bus 109 and a processor 111 . Some of these blocks may be omitted in accordance with a modification of the analyzing apparatus 100. Or a block not shown in Fig. 1 may be further included in this hardware block diagram.

The input interface 101 is an interface that can receive user input from a user (analyst) to analyze an executable file to which the virtualization obfuscation technique is applied. The input interface 101 receives user input from a keyboard, mouse, touch panel, and the like and passes it to the processor 111 to select an executable file to be analyzed, to start analysis of the executable file, or to stop the analysis.

The output interface 103 is an interface capable of outputting a processing result according to a user input or a result of a processing procedure. The output interface 103 converts data to be output to a speaker, a display, or the like into a data format required for a speaker, a display, or the like, and outputs the converted data. The output interface 103 can output log data generated by analyzing an executable file to which the virtualization obfuscation technique is applied, for example.

The memory 105 includes volatile memory and / or non-volatile memory. The memory 105 is configured to temporarily store or permanently store data used in various programs, program modules, and programs.

The mass storage medium 107 includes a hard disk and / or a USB memory. The mass storage medium 107 stores various programs to be executed on the processor 111. [

For example, the mass storage medium 107 stores at least one execution file to which the virtualization obfuscation technique is applied as an analysis target, and an analysis program file for analyzing the execution file. These files may be executed in the processor 111. The executable file and the analysis program file may be loaded into the memory 105 via the input interface 101 and executed in the processor 111. [

The system bus / control bus 109 makes it possible to send and receive data between blocks. The system bus / control bus 109 may be, for example, a parallel bus, a serial bus, a general purpose input output (GPIO), or a combination of such buses or GPIOs.

The processor 111 may include one or more execution units capable of executing instructions to perform instructions contained in the program. The processor 111 is configured to load a file stored in the mass storage medium 107 into the memory 105 and process the loaded file according to user input.

Here is a brief description of the structure of the executable file with the virtualization obfuscation technique. The executable file includes virtualization code with virtualization obfuscation technique and virtual processor for processing virtualization code. The virtualization code and virtual processor can be applied to every section or sector of an executable file or to some sections or sectors depending on the programmer's choice of generating the executable file.

The processor 111 can not directly process the virtualization code stored in the executable file by loading it as an instruction into the execution unit. Instead, the virtual processor for storing the virtualization code stored in the executable file performs real-time conversion of the virtualization code into an instruction that can be processed by the processor 111 to perform a function corresponding to the virtualization code. Therefore, the virtualization code is not restored to the original code at the time of execution of the executable file. It is easy to identify the virtualization code or the virtual processor through the debugger or the like, or interpret the control flow according to the virtualization code by applying a plurality of obfuscation techniques. impossible.

Virtual processor and virtualization code can take many forms and structures depending on commercial software tools that apply virtualization obfuscation techniques.

Referring to FIG. 2, a typical virtualization code and a structure of a virtual processor are shown. The virtualization code includes a series of virtualization commands. The virtualization code is stored in an arbitrary location (address) area on the executable file. A virtualization instruction consists of one or two bytes, and each virtualization instruction can perform a specified function.

The virtual processor is configured to sequentially read the virtualization commands of the virtualization code and to directly execute the function corresponding to the read virtualization command on the processor 111 of the hardware block diagram.

Typically, the virtual processor includes a dispatch loop code, a handler table, and a plurality of handler codes. The dispatch loop code reads the virtualization instructions one by one and allows you to execute the corresponding handler code. The handler table stores the start address of the handler code. Through the start address stored at a specific address in the handler table, the dispatch loop code is configured to call specific handler code. The handler code is a code that performs a function corresponding to a virtualization command. The handler code is composed of instructions executed in an execution unit of the processor 111 and executed by the processor 111 corresponding to the virtualization instruction by executing the handler code on the processor 111. [

The components applied to the virtualization obfuscation technique include the virtualization code, the dispatch loop code of the virtual processor, the handler table, and a plurality of handler codes. These components are representative components of commercial software tools that employ virtualization obfuscation techniques, and may be components of, for example, Themida v2.1.8. Other commercial tools also have similar names or forms.

The components applied to the virtualization obfuscation technique are embedded in the executable file, scattered in the executable file, and problems arise because the components can not be easily identified or extracted by a jump or an additional operation.

The analyzing apparatus 100 as described above may be, for example, a personal computer, a terminal capable of connecting to a server, a workstation, or an analysis server that can be connected to a plurality of terminals.

3 is a diagram illustrating an exemplary control flow of an executable file analysis method to which a virtual obfuscation technique is applied. The control flow of FIG. 3 may be performed on the analysis apparatus 100 of the exemplary hardware block diagram of FIG. 2, and preferably by the processor 111 loading and executing an analysis program or the like stored in the mass storage medium 107 . The control flow according to the present invention preferably utilizes static analysis that utilizes log data that has been generated without using real-time analysis such as a debugger.

First, before the step S101, the control flow starts (SlOO) by the user using the analyzing apparatus 100 selecting through the input interface 101 a dynamic emulator which is one of the analysis programs.

Thereafter, in step S101, the analysis apparatus 100 loads an execution file, which is an analysis object file, in the dynamic emulator as a user input through the input interface 101. [ The analysis apparatus 100 then executes the executable file using a dynamic emulator. The analysis apparatus 100 then generates log data (hereinafter, referred to as 'first log data') including all the commands according to the execution and expressing all commands through the output interface 103 according to the execution order, (105) or the mass storage medium (107). The first log data includes both instructions executed in the processor 111 and information related to the address of the instruction, and the instructions are sequentially recorded according to the execution order of the execution file.

The dynamic emulator can be used, for example, in Linux or the like, configured to be able to apply dynamic tracing, and preferably be 'QEMU', virtualization software.

The first log data includes instructions and addresses of at least a dispatch loop (also referred to as a 'main handler', hereinafter, used interchangeably), addresses and handler code instructions and addresses in the order of execution. Accordingly, a plurality of dispatch loops and handler codes exist in the first log data according to the execution order and are scattered. Debugger, etc., the recorded first log data extracts the components applied to the virtualization obfuscation technique, including all the instructions that can be used in the processor 111 according to the execution order, It is very advantageous to display.

Thereafter, in step S103, the analysis apparatus 100 loads the recorded first log data to the memory 105 or the like for identification and analysis of the components. This step S103 may be omitted according to the design variant.

In step S105, the analysis apparatus 100 identifies the component applied to the virtual obfuscation technique from the first log data generated based on the executable file to be analyzed (for example, the first log data recorded in step S101) .

These components can be extracted through analysis of the first log data. Specifically, the component includes a dispatch loop executed to execute a specific handler code corresponding to a specific virtualization command included in an executable file to be analyzed, and a plurality of handler codes executed by a call by a dispatch loop. The component may further include a virtualization code and a handler table. These components can be extracted by analyzing the instructions included in the first log data and executed in accordance with the execution order.

In step S105, the processor 111 of the analyzing apparatus 100 extracts from the first log data the contents of the dispatch loop or the plurality of handler codes, Identify the code area first.

The dispatch loop reads the virtualization instructions one by one, such as one or two bytes of the virtualization code area. The dispatch loop then performs several operations on the read virtualization instruction multiple times to determine the address of the handler table, and the address (indirect jump) recorded at the corresponding address in the handler table so that the handler code corresponding to the address of the determined handler table is executed .

As a result of in-depth analysis of the log data of arbitrary executable files using the dummy data as the commercial software tool, it can be seen that the dummy executable file has the virtualization structure as shown in FIG. Each code, dispatch loop, or handler table can be created in different locations or sizes depending on the type of the executable file and the time of creation.

4, the dispatch loop accesses the virtualization code, reads one virtualization instruction, performs operations on the read virtualization instruction, and calls the handler code with reference to the handler table according to the operation result do. Then, the called handler code performs a substantial function corresponding to the virtualization instruction through the processor 111 and is configured to call the dispatch loop again (start address of the dispatch loop) when the execution is completed. The dispatch loop then reads the subsequent virtualization instructions and performs the same process.

Thus, the dispatch loop is repeatedly executed to process the virtualization code through the processor 111, and the executed handler code is configured to call the dispatch loop again.

Based on these analysis results, the code area of the dispatch loop can be identified. The code region of the dispatch loop is characterized in that it is repeatedly executed to perform a plurality of virtualization instructions of the virtualization code as described above. The first instruction of the dispatch loop is associated with the virtualization instruction, and the virtualization instruction is transferred to a specific register A feature that loads the last instruction of the dispatch loop is composed of an instruction that jumps to one handler code determined through a specific area (area of the handler table), and a jumping handler code is a feature that returns to the first instruction of the dispatch loop again .

Using the features of this dispatch loop, it is possible to identify the code area of the dispatch loop in the first log data.

For example, the analyzing apparatus 100 can recognize the first instruction and the last instruction of the dispatch loop multiple times through a scan of the first log data. The analysis apparatus 100 determines the address corresponding to the first instruction associated with the virtualization instruction as the start address of the dispatch loop and the address corresponding to the last instruction for calling the handler code as the end address of the dispatch loop, Can be identified.

In step S105, after identifying the area of the dispatch loop, other components can be easily identified.

For example, the analyzing apparatus 100 can know the code area of the handler table in the last instruction of the code area of all the dispatch loops of the first log data, and further know the starting address of the actually called handler codes. Also, after the instruction of the start address of the handler code is executed, the end address of the handler code can be known by the instruction of the handler code which calls the first instruction of the dispatch loop again. You can also identify the area of the virtualization code with the instruction at the first address of all dispatch loops.

Other components besides this dispatch loop may be identified through the instructions of the dispatch loop identified and rescan the first log data.

Thereafter, in step S107, the information related to the identified component is configured to be recognizable by the user to generate log data (hereinafter referred to as "second log data"). The second log data includes, for example, information indicating a start address and an end address for identifying the area of the virtualization code, information indicating a start address and an end address of the dispatch loop so as to know the code area of the dispatch loop, Information indicating instructions, information indicating the number of times each handler code is executed, and information indicating the order of execution between handler codes.

The second log data includes information indicating a start address of each handler code, instructions included in the handler code, an operand of each instruction, an execution order of the handler code when the execution of the execution file is executed a plurality of times As shown in FIG.

This second log data may be generated by identifying (or extracting) the dispatch loop and other components from the first log data. For example, the second log data may be generated at the same time during identification of the component in step S105, or after all the components are identified in step S105, the information of the corresponding component may be generated by scanning again the first log data .

For example, the execution count of the second log data can be known by counting the same start address (via the handler table) invoked in the dispatch loop, and the execution order between the handler codes can be determined by the execution order of the first log data And the handler codes to be found are listed in order.

Thereafter, in step S109, the analysis apparatus 100 may output the generated second log data through the output interface 103 or may store it in the mass storage medium 107. [

5 and 6 illustrate exemplary forms of the generated second log data. 5, the second log data includes area information of the virtualization code and area information of the dispatch loop (see (1)), dispatch loop commands (see (2)), area information for each of the plurality of handlers, (See ③) and execution order between multiple handlers (see ④).

FIG. 6 is a diagram showing second log data generated in association with a specific handler code. As can be seen from FIG. 6, the start address (refer to?) Of the handler code, the commands (Eg, memory, registers, constants, and addresses) or values (see ②), and the execution sequence number (see ③, for example) that tells you how many times the handler code is executed Quot; 1 " is the execution sequence number indicating the first execution in " H 1-115 ").

The second log data in FIGS. 5 and 6 may be stored in one file or in a different file. In addition, the second log data of FIGS. 5 and 6 may be displayed through one window or through several different windows.

As can be seen in FIGS. 5 and 6, the second log data generated according to the present invention may provide various information related to the virtual obfuscation technique. In particular, the components applied to the virtualization obfuscation technique can be identified and displayed in accordance with the execution flow of the actual executable file through the static analysis method. It also provides the number of times the handler code has been executed so that the analyst can guide which handler code needs to be analyzed first, and provides a control flow between handler codes to facilitate analysis of the virtualization code.

The control flow of FIG. 3 may then be terminated (S200) according to user input via the input interface 101. FIG.

The control flow according to FIG. 3 may be performed by executing one program executed on the processor 111 of the analysis apparatus 100 or by executing a plurality of programs. For example, the step S101 may be performed on another program (for example, a dynamic emulator), and the remaining steps S103 to S109 may be performed using another program (analysis program for extracting the components).

7 is a diagram illustrating an exemplary functional block diagram for analysis of an executable file to which a virtual obfuscation technique is applied. The functional block diagram of Fig. 7 may be performed on the hardware block diagram of Fig. Preferably, the functional block diagram of FIG. 7 may be configured using programs or the like stored in the mass storage medium 107 or the like, which are performed by the processor 111 of FIG.

The analysis of the executable file through the control flow of FIG. 3 has been described in detail.

The analysis apparatus 100 according to FIG. 7 includes an emulation module 151, a component identification module 153, and a log generation module 155. The analysis apparatus 100 may omit specific modules as needed, for example, the emulation module 151 may be omitted according to a modification. Here, the reference numerals of the function blocks (use number 150) are assigned to distinguish them from the reference numerals of the hardware blocks.

The emulation module 151 loads the executable file to be analyzed in the memory 105 according to the user input and executes all instructions corresponding to the execution of the executable file dynamically according to the execution of the executable file And generates and records the first log data including all the executed commands and expressing all the commands according to the execution order. The executable file may be a file created by applying a dummy application, which is a commercial software tool that applies virtualization obfuscation techniques.

The component identification module 153 identifies the components of the virtualization obfuscation technique applied to the executable file from the first log data generated based on the executable file. For example, the component identification module 153 can identify a dispatch loop, a plurality of handler codes, and further identify virtualization code and handler tables. The first log data is preferably log data recorded by the emulation module 151.

Specifically, the component identification module 153 scans the first log data to identify the dispatch code area. The dispatch code region has a feature that it is repeatedly performed by scanning the first log data, and has a first instruction for loading the virtualization instruction in the repeatedly executed code region and a last instruction for calling the handler code. You can identify the region of the dispatch code by recognizing the first and last instructions of the code and determining the start address and end address of the dispatch code from it.

The component identification module 153 may further identify each of the plurality of handler codes using instructions (e.g., the last instruction) of the identified dispatch code area. For example, the component identification module 153 recognizes the start address (via the handler table) that is called via the last instruction of the area of the plurality of dispatch codes identified in the first log data. Further, the component identification module 153 recognizes a command to be called with the start address of the dispatch code again according to the execution of the instruction after the recognized start address, and identifies the code area including the start address and the end address of the handler code have.

The log generation module 155 generates second log data such that various information related to the components identified by the component identification module 153 can be recognized by the user. The log generation module 155 outputs the area information related to the component, the execution count of the handler code, the execution order between the handler codes, and the instruction of the component, through the output interface 103, 107).

The functional blocks of FIG. 7 may be configured as a program that can be executed in a processor, and each block may be a separate program, integrated into one program, or integrated into a plurality of programs. For example, the emulation module 151 may be constituted by one program (for example, a dynamic emulator), and the component identification module 153 and the log generation module 155 may be constituted by separate programs.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

100: Analyzer
101: input interface 103: output interface
105: memory 107: mass storage medium
109: system bus / control bus 111: processor
151: Emulation module 153: Component identification module
155: log generation module

Claims (12)

An analysis method of an executable file to which a virtualization obfuscation technique is applied,
(a) loading the executable file into a dynamic emulator, generating and recording first log data that includes all instructions executed in the dynamic emulator and can represent all of the instructions in an execution order;
(b) identifying components applied to the virtual obfuscation technique from the first log data generated based on the executable file; And
(c) generating second log data capable of recognizing information associated with the identified component,
Wherein the component applied to the virtualization obfuscation includes a dispatch loop for executing a handler code corresponding to a virtualization instruction included in the executable file and a plurality of handler codes executed by the dispatch loop,
The step (b)
(b-1) identifying a code region of the dispatch loop; And
(b-2) identifying an area of a plurality of handler codes using an instruction of a code area of the dispatch loop identified in step (b-1)
The step (b-1)
Recognizing a first instruction related to a virtualization instruction and a second instruction for calling a handler code corresponding to the virtualization instruction; And
Determining a start address and an end address of a dispatch loop from a location of the recognized first instruction and a second instruction,
How to analyze executable files. delete delete The method according to claim 1,
Wherein the executable file is an executable file generated by applying the commercial virtualization obfuscation tool, Themida. delete The method according to claim 1,
The second log data generated in the step (c) includes information indicating a start address and an end address of the dispatch loop, information indicating the execution count of each of the plurality of handler codes, and information indicating execution order between the plurality of handler codes ,
How to analyze executable files. The method according to claim 6,
Wherein the second log data generated in the step (c) further includes information indicating a start address of the handler code, an instruction contained in the handler code, an operand included in the instruction, and an execution order of the handler code.
How to analyze executable files. An apparatus for analyzing an execution file to which a virtualization obfuscation technique is applied,
An emulation module for loading the executable file and including first and second dynamically executed instructions to generate and record first log data capable of expressing all of the instructions in an execution order;
A component identification module for identifying a component applied to the virtual obfuscation technique from the first log data generated based on the executable file; And
And a log generation module for generating second log data capable of recognizing information related to the identified component,
Wherein the component applied to the virtualization obfuscation includes a dispatch loop for executing a handler code corresponding to a virtualization instruction included in the executable file and a plurality of handler codes executed by the dispatch loop,
Wherein the component identification module identifies a code region of the dispatch loop, identifies an area of a plurality of handler codes using instructions in a code region of the identified dispatch loop,
The component identification module recognizes a first instruction related to the virtualization instruction and a second instruction for calling the handler code corresponding to the virtualization instruction and recognizes the start address of the dispatch loop from the position of the recognized first instruction and the second instruction Determining an end address to identify a code region of the dispatch loop,
Analyzer of the executable file. delete delete 9. The method of claim 8,
Wherein the executable file is an executable file generated by applying a dummy variable that is a commercial virtualization obfuscation tool. delete

Images